Microsoft’s July 14, 2026 Windows security updates start a three-month countdown for AD FS administrators: the updates now audit Distributed Key Manager container permissions, and automatic ACL remediation begins October 13, 2026 on Windows Server 2016 and later.
Microsoft detailed the change in KB5121391, which addresses CVE-2026-56155. AD FS uses its DKM container in Active Directory to hold symmetric keys protecting token-signing and token-encryption certificate private keys. A permissive container ACL could let an attacker who can read that key material decrypt token-signing private keys.
The July update does not modify the DKM ACL by itself. Instead, AD FS checks the container one minute after service startup and then every 24 hours. Administrators should review the AD FS/Admin log:
That is the potentially disruptive part of the update. Organizations that have added delegated identities, service accounts, or custom automation to the DKM container must identify those dependencies before enforcement. Event ID 1135 records a successful remediation and includes the prior ACL in SDDL form; Microsoft recommends exporting that event data promptly because normal event-log rollover can erase the rollback information.
Windows Server 2012 and Windows Server 2012 R2 are the exception. Automatic October enforcement does not apply there. Before opting into remediation, administrators must grant the AD FS service account
For AD FS remains a high-value identity component, the practical task is straightforward: install the July update across every federation server, watch for Event ID 1132, test remediation before October 13, and preserve the Event ID 1135 SDDL if a rollback plan is needed.
Microsoft detailed the change in KB5121391, which addresses CVE-2026-56155. AD FS uses its DKM container in Active Directory to hold symmetric keys protecting token-signing and token-encryption certificate private keys. A permissive container ACL could let an attacker who can read that key material decrypt token-signing private keys.
July is the compatibility window
The July update does not modify the DKM ACL by itself. Instead, AD FS checks the container one minute after service startup and then every 24 hours. Administrators should review the AD FS/Admin log:- Event ID 1132 means the ACL does not meet Microsoft’s new secure baseline.
- Event ID 1133 confirms that the container is already compliant.
- Event ID 1134 indicates the detection task failed, such as from an LDAP connectivity problem.
HKLM\SOFTWARE\Microsoft\ADFS\RemediateDkmAcl to DWORD 1 on one AD FS server. The next detection cycle applies the change, while restarting the AD FS service triggers it sooner.The new baseline removes inherited access
Remediation disables inheritance on the DKM container, discards inherited access-control entries, and removes explicit Allow permissions other than those required by Microsoft’s baseline. The permitted principals are Domain Admins, Enterprise Admins, SYSTEM, and the AD FS service account.That is the potentially disruptive part of the update. Organizations that have added delegated identities, service accounts, or custom automation to the DKM container must identify those dependencies before enforcement. Event ID 1135 records a successful remediation and includes the prior ACL in SDDL form; Microsoft recommends exporting that event data promptly because normal event-log rollover can erase the rollback information.
October changes the default
With the October 2026 security update, AD FS on Windows Server 2016 and later will remediate insecure DKM ACLs by default, equivalent toRemediateDkmAcl=1. An administrator can explicitly defer that action with DWORD 0, but Microsoft warns that doing so leaves the vulnerable configuration in place; detection warnings will continue.Windows Server 2012 and Windows Server 2012 R2 are the exception. Automatic October enforcement does not apply there. Before opting into remediation, administrators must grant the AD FS service account
WriteOwner and WriteDacl permissions on the DKM container, or the repair attempt will fail.For AD FS remains a high-value identity component, the practical task is straightforward: install the July update across every federation server, watch for Event ID 1132, test remediation before October 13, and preserve the Event ID 1135 SDDL if a rollback plan is needed.
References
- Primary source: Microsoft - Message Center
Published: 2026-07-29 14:00 PT
Loading…
support.microsoft.com